8 Our staff are pasting customer data into ChatGPT.

ReadyLab and laptop~6 minApplication LibraryGateway HTTP policiesBrowser IsolationAI prompt logging

What the company has decided about each AI service, enforced: the sanctioned one inspected, the one under review isolated, the rest redirected to a page naming the two approved paths.

The problem

Horizon Inc's staff use whatever AI service is to hand, and the one that matters is the one somebody pastes a customer list into on a busy afternoon. Blocking every AI site stops nobody - they go around it. The company has made decisions: one assistant approved, one under review, the rest not. It needs those decisions enforced, and the sanctioned path made obvious.

Lands with: CISOs and anyone writing an AI acceptable-use policy

Before you start

The protection layer deployed in block mode - ./protect.sh block on a laptop deploy, protection_mode = "block" in the lab.
The Cloudflare One client enrolled as , with the Cloudflare root certificate trusted (the client installs it).
A customer list to paste: any customer page in Pipeline, which carries contact mobiles and deal terms.
The DLP private key to hand, from the DLP key page, for the last step.

Run it

What the company has decided

Do	Say
Zero Trust → Team & Resources → Application Library, filtered to Artificial Intelligence.	Every AI service carries a status the company sets: ChatGPT approved, Google Gemini in review, Claude, Copilot, DeepSeek and the rest unapproved. The policies act on these decisions, not on a list of hostnames someone has to keep up to date.
Traffic policies → Firewall policies → HTTP: Prevent sensitive data reaching public AI, Isolate applications in review, Redirect non approved AI.	Three answers for three decisions. Approved is inspected. In review is usable but sealed. Unapproved is redirected rather than refused, because a refusal sends people looking for a way around.

In the browser

Do	Say
As Alice, open `claude.ai`.	It does not refuse - it lands on a page offering the two sanctioned paths: ChatGPT for non-sensitive work, and the company's own assistant for anything sensitive. The lesson, delivered at the moment it is relevant.
Open `gemini.google.com`, ask anything, then try to copy the answer.	It works - it is running in a remote browser on Cloudflare's network - and nothing comes out of it: copy, paste, download, upload and print are off. Keyboard stays on, because a chat you cannot type into is an outage, not a control.
Open `chatgpt.com` and paste the Pipeline customer list into a prompt.	ChatGPT is approved, and still this is blocked - with a desktop notification saying why. The company sanctioned the tool, not the customer data leaving through it.

What the audience should see

claude.ai arriving at the chooser page rather than an error.
Gemini working, and copy refused.
The ChatGPT prompt refused, and the Cloudflare One client notification: Blocked access to AI due to detection of sensitive data.

Where the evidence is

Gateway HTTP logs: the blocked ChatGPT request with the application, the prompt operation and the AI Prompt profile that matched. Expand it and use Decrypt payload log with the private key - the prompt itself appears under the generative AI section. The redirect for claude.ai is a separate row carrying its review status.

Known limitations

The DLP rule targets ChatGPT specifically, because prompt logging only works on a policy that names an application. An approved AI service other than ChatGPT would not be inspected - there is none here.
Shadow IT discovery needs traffic to discover; on a fresh lab the dashboard may be nearly empty.

The longer version is step 1 of the walkthrough, and the policies are explained on the controls page.

Part of: The whole of Cloudflare One · AI security · The full tour